RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contribution Amount Not Updated in contribute Function

monteago30

Summary

The contribute function transfers SOL from the contributor to the fund account but doesn't properly update the individual contribution amount in the contribution record.

Vulnerability Details

When a user contributes to a fund, the SOL is correctly transferred to the fund account and the fund's amount_raised is properly incremented. However, the individual contribution's amount field is only set to 0 when the contribution record is created, but is never updated when additional contributions are made:

// Contribution amount is initialized to 0
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
​
// SOL transfer happens here
system_program::transfer(cpi_context, amount)?;
​
// Fund total is updated
fund.amount_raised += amount;
// Missing: contribution.amount += amount;

Impact

This vulnerability has severe implications for the refund functionality. Since individual contribution amounts aren't being tracked properly, the refund function will not work as expected:

  1. Users who have contributed multiple times will only be able to refund their first contribution

  2. In some cases, users might not be able to get any refund at all

  3. The calculation for refunds will be incorrect, potentially leading to some users being unable to claim their funds

This could result in permanent loss of user funds.

Tools Used

Manual code review

Recommendations

Update the contribute function to properly track individual contribution amounts:

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
​
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
// Transfer SOL from contributor to fund account
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
fund.amount_raised += amount;
contribution.amount += amount; // Add this line to update the contribution amount
Ok(())
}
Updates

Appeal created

bube Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.